No, this would not pass the Security Review, and is inappropriate for a managed package, which should not steal the authentication data of its users. If you want to act on behalf of a user, don't impersonate the user, but ask the user to authorize you to act on their behalf: use an OAuth token with a scope agreed to by the user.
It's pretty easy to setup a connected app and get user authorization, and this has the benefit of giving you a refresh token as well. Now with JWT flows, it's even easier, whereas a session id leaves no audit trail, is effectively sharing auth credentials, and can be done silently without the victim's knowledge or consent. Please don't abuse your users' authentication data this way -- this is private user data that does not belong to a managed package. Rely on your own authentication data and have users authorize you to act on their behalf.